Your information, in plain language

About your information

This practice serves people of all ages. A portal account can be created and managed by you, or by a caregiver enrolling someone on their behalf. When you sign up, you're consenting to us holding and using the information needed to provide care, whether that's your own or that of the person you're enrolling.

What we collect

We only ask for what helps us provide care and run the practice. Most of it comes straight from the intake form you fill out, and you can share as much or as little as you like; only your name and email are required.

• About you: your name, email, phone if you give it, your relationship to the client (if you're enrolling someone else), your preferred way to be contacted, and a portal password. Your email is also how you sign in.
• About the person receiving care: first name, age, and, if you choose to share them, date of birth and pronouns. The last name is taken from the surname on the account.
• What brings you here: the focus areas you select and anything you write in your own words, calming strategies, sensory notes, favourite music, current therapies or supports, prior music-therapy history, a referring provider, preferred session setting and times, when you'd like to start, how you plan to pay, and how you heard about us.
• Your whole intake: to be straightforward with you, the complete intake form, including every free-text answer, is saved exactly as you submitted it.
• Once care is underway: your sessions (time, place, status), the two-way messages between you and Glow MT, goals and progress on the treatment plan, and invoices (amounts, dates, and status).
• Clinical records we keep: session notes, assessments, and treatment plans written as part of our clinical work.

We keep a behind-the-scenes activity log of important actions (such as sign-ins, data exports, and account deletions) so the practice can keep accounts secure and answer questions about what happened and when. Each entry records the action, the account involved, and the time.

How we use it

Your information is used to provide and run Glow MT's music-therapy practice, never to sell to anyone or to advertise to you. Specifically, we use it to:

• Create and sign you in to your portal (with your email and password, or a passkey if you add one).
• Let us review your intake, get in touch, and show you where things stand: Received, In review, Scheduled, or Started.
• Schedule sessions and show your upcoming and past visits in the portal.
• Carry messages back and forth between you and Glow MT.
• Document care, write session notes, treatment plans, and goals (this is our clinical work).
• Send invoices and show them in your portal.
• Send you the practical emails you'd expect, an intake confirmation, scheduling notes, replies, a password-reset link, a portal invite, and invoices, and to alert Glow MT when something needs attention (a new intake, a new portal message, or an account being deleted).
• Keep the practice secure and accountable through the activity log described above.

Clinical notes stay private to your therapist

Glow MT's clinical session notes and assessments are written for clinical use. They are not shown in your portal and are not part of anything you can download from it. The portal is built so that clients never reach those staff-only clinical records.

What you do see in the portal is your overview, sessions, goals and progress, billing, and your messages. If we want to share something with you, we'll write it to you directly as a portal message.

Who we share it with

We don't sell your information and we don't share it for advertising. To run the portal at all, your information is handled by a small set of trusted service providers who work on the practice's behalf:

• A cloud hosting and database provider that runs the application and stores its data.
• An email delivery provider that sends the practice's emails, used only when email sending is switched on.

When you load our pages, your browser also requests fonts from Google Fonts so the site looks the way it should. Beyond these providers, and anyone you ask us to coordinate with, we don't hand your information to outside parties. If you'd like to know exactly which companies we currently use, just email us and we'll tell you.

A word on email: we keep clinical details (like diagnoses or the content of clinical notes) out of email on purpose, emails link you back into the portal instead. Some emails do, by necessity, contain a little personal information, for example a first name, an appointment time and place, or, in the alert Glow MT gets when you send a portal message, a short snippet of the message you wrote.

How it's protected

We take real, concrete steps to keep your information safe. Here's what's true today:

• Encrypted in transit. Connections to the site and portal use HTTPS, so information is encrypted while it travels between your device and our servers.
• Passwords are hashed, never stored as text. Your portal password is saved only as a one-way scrambled value (a salted scrypt hash), so even we can't read it, and portal passwords must be at least 8 characters.
• Passkeys, if you want one. Alongside your password, you can add a passkey (Face ID, Touch ID, or a security key) for a stronger, phishing-resistant way to sign in.
• Separate, revocable sign-ins. Sessions are tied to a random token, and signing out ends them. Reset and invite links expire on their own.
• Role-based access. Staff and client accounts are kept strictly apart, and clinical notes are limited to the clinical role.
• Guarded against abuse. Sign-in and other sensitive requests are rate-limited to slow down guessing, and the database queries are written to prevent injection.
• Activity logging. Important actions are recorded so the practice can keep accounts honest and secure.

To be candid about the limits: no online service is ever perfectly secure, and this page does not claim any specific certification or compliance program. Information is protected in transit and passwords are hashed, but message content, intake answers, and notes are stored in readable form on our database provider's systems. You can sign in with your password or a passkey; we do not yet offer SMS or app-based two-step codes.

Cookies

We use cookies only to keep you signed in, two small first-party session cookies, one for the practice's staff and one for the client portal. They hold a random token, not your identity; they're set so JavaScript can't read them (HttpOnly) and, in our live service, are marked Secure so they're only sent over HTTPS. We don't use third-party, advertising, or tracking cookies. Your accessibility preferences are saved on your own device (in your browser's local storage) and aren't sent to us.

Your choices

From the Privacy & data tab inside your portal, you can:

• Download your data (CSV). Get a spreadsheet-friendly copy of what's held for you in the portal, your details, intake (including the free-text answers you submitted), sessions, the full text of your messages, goals and progress, and invoices. (Glow MT's clinical session notes are staff-only and aren't part of this export.)
• Delete your account. This closes your ability to sign in; see exactly what happens below.
• Ask us to correct your information. If something is wrong or out of date, email us (see below) and we'll update it for you.

What happens to your records after you delete your account. So we're not misleading: deleting your account closes your portal sign-in, but it does not erase the practice's records. Your portal login record itself isn't removed; instead it's kept but scrubbed of your name and email, and the password is replaced, so it can no longer be used to sign in. The clinical records, your intake, messages, sessions, invoices, and the activity log are intentionally kept by the practice for clinical, billing, and record-keeping reasons. The activity log keeps a note of the deletion (including a reference to the original account), and Glow MT is notified. There is no automatic schedule that deletes this information later. If you'd like to discuss your records, contact us directly.

How to make a request or ask a question

For anything about your information, a copy, a correction, a question about what we hold, or to talk through your records, email brooklyn@glowmt.com. We read these and will get back to you.

Changes to this page

If how we handle information changes, we'll update this page and refresh the dates below.